On fast large-scale program analysis in Datalog

Abstract

Designing and crafting a static program analysis is challenging due to the complexity of the task at hand. Among the challenges are modelling the semantics of the input language, finding suitable abstractions for the analysis, and handwriting efficient code for the analysis in a traditional imperative language such as C++. Hence, the development of static program analysis tools is costly in terms of development time and resources for real world languages. To overcome, or at least alleviate the costs of developing a static program analysis, Datalog has been proposed as a domain specific language (DSL). With Datalog, a designer expresses a static program analysis in the form of a logical specification. While a domain specific language approach aids in the ease of development of program analyses, it is commonly accepted that such an approach has worse runtime performance than handcrafted static analysis tools. In this work, we introduce a new program synthesis methodology for Datalog specifications to produce highly efficient monolithic C++ analyzers. The synthesis technique requires the re-interpretation of the semi-naïve evaluation as a scaffolding for translation using partial evaluation. To achieve high-performance, we employ stagedcompilation techniques and specialize the underlying relational data structures for a given Datalog specification. Experimentation on benchmarks for large-scale program analysis validates the superior performance of our approach over available Datalog tools and demonstrates our competitiveness with state-of-the-art handcrafted tools.

Debreach: Mitigating Compression Side Channels via Static Analysis and Transformation

“…We also note here that we tried to use off-the-shelf solvers such as Souffle [62] to solve our Datalog programs. While Souffle finished in all cases, we found that our Python-based solver finished much faster in some cases.…”

Precision-guided context sensitivity for pointer analysis

“…In RQ1, we consider a 2-object-sensitive pointer (2obj) analysis (with one context element for heap objects) [Milanova et al 2002[Milanova et al , 2005 as the conventional context-sensitive pointer analysis we seek to match in terms of precision. 2obj is regarded as the most practical high-precision pointer analysis for Java [Lhoták and Hendren 2006;Smaragdakis et al 2011;] and is widely adopted in recent literature [Hassanshahi et al 2017;Jeong et al 2017;Scholz et al 2016;Smaragdakis et al , 2014Tan et al 2017;Thiessen and Lhoták 2017] and analysis tools, including popular static analysis frameworks for Android [Arzt et al 2014;Gordon et al 2015]. Relative to other k-object-sensitive analyses, 2obj is significantly more precise than 1obj Smaragdakis et al 2011], and 3obj does not scale for most DaCapo benchmarks [Tan et al 2017].…”

Soufflé: On Synthesis of Program Analyzers

“…A naive implementation would be to have two indices defined by the lexicographical orders u and u < v, however, the minimal solution would be to have only one index, namely, u < v as it subsumes the index with only u. Some information to our solution to this combinatorial problem can be found in [13]. The variadic template for the struct Comperator is parametrized by the columns in order.…”

“…We point the reader to [5] for information on the Java vulnerabilities work at Oracle. For more detailed performance data on the techniques used in SOUFFLÉ , we refer the reader to [13].…”